diff --git a/CHANGES b/CHANGES
index 6293d66cec..9110f26af0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,4 +1,8 @@
 
+2.6-335 | 2019-05-24 08:58:59 -0700
+
+  * Fix memory leak when no protocol_violation event handler exists (Jon Siwek, Corelight)
+
 2.6-334 | 2019-05-23 20:40:03 -0700
 
   * Add an internal getenv wrapper function: zeekenv (Jon Siwek, Corelight)
diff --git a/VERSION b/VERSION
index 216f0627d7..7fd574fa3b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-2.6-334
+2.6-335
diff --git a/src/analyzer/Analyzer.cc b/src/analyzer/Analyzer.cc
index 874b405e9d..9977d44e70 100644
--- a/src/analyzer/Analyzer.cc
+++ b/src/analyzer/Analyzer.cc
@@ -679,6 +679,9 @@ void Analyzer::ProtocolConfirmation(Tag arg_tag)
 
 void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
 	{
+	if ( ! protocol_violation )
+		return;
+
 	StringVal* r;
 
 	if ( data && len )
@@ -692,9 +695,6 @@ void Analyzer::ProtocolViolation(const char* reason, const char* data, int len)
 	else
 		r = new StringVal(reason);
 
-	if ( ! protocol_violation )
-		return;
-
 	EnumVal* tval = tag.AsEnumVal();
 	Ref(tval);